Skip to content

Commit 433c60e

Browse files
nginxkolbyjack
nginx
authored and
kolbyjack
committed
Changes with nginx 1.5.11 04 Mar 2014
 *) Security: memory corruption might occur in a worker process on 32-bit platforms while handling a specially crafted request by ngx_http_spdy_module, potentially resulting in arbitrary code execution (CVE-2014-0088); the bug had appeared in 1.5.10. Thanks to Lucas Molas, researcher at Programa STIC, Fundación Dr. Manuel Sadosky, Buenos Aires, Argentina. *) Feature: the $ssl_session_reused variable. *) Bugfix: the "client_max_body_size" directive might not work when reading a request body using chunked transfer encoding; the bug had appeared in 1.3.9. Thanks to Lucas Molas. *) Bugfix: a segmentation fault might occur in a worker process when proxying WebSocket connections. *) Bugfix: a segmentation fault might occur in a worker process if the ngx_http_spdy_module was used on 32-bit platforms; the bug had appeared in 1.5.10. *) Bugfix: the $upstream_status variable might contain wrong data if the "proxy_cache_use_stale" or "proxy_cache_revalidate" directives were used. Thanks to Piotr Sikora. *) Bugfix: a segmentation fault might occur in a worker process if errors with code 400 were redirected to a named location using the "error_page" directive. *) Bugfix: nginx/Windows could not be built with Visual Studio 2013.
1 parent 7906d14 commit 433c60e

26 files changed

+188
-79
lines changed

‎CHANGES‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,39 @@
11

2+
Changes with nginx 1.5.11 04 Mar 2014
3+
4+
*) Security: memory corruption might occur in a worker process on 32-bit
5+
platforms while handling a specially crafted request by
6+
ngx_http_spdy_module, potentially resulting in arbitrary code
7+
execution (CVE-2014-0088); the bug had appeared in 1.5.10.
8+
Thanks to Lucas Molas, researcher at Programa STIC, Fundación Dr.
9+
Manuel Sadosky, Buenos Aires, Argentina.
10+
11+
*) Feature: the $ssl_session_reused variable.
12+
13+
*) Bugfix: the "client_max_body_size" directive might not work when
14+
reading a request body using chunked transfer encoding; the bug had
15+
appeared in 1.3.9.
16+
Thanks to Lucas Molas.
17+
18+
*) Bugfix: a segmentation fault might occur in a worker process when
19+
proxying WebSocket connections.
20+
21+
*) Bugfix: a segmentation fault might occur in a worker process if the
22+
ngx_http_spdy_module was used on 32-bit platforms; the bug had
23+
appeared in 1.5.10.
24+
25+
*) Bugfix: the $upstream_status variable might contain wrong data if the
26+
"proxy_cache_use_stale" or "proxy_cache_revalidate" directives were
27+
used.
28+
Thanks to Piotr Sikora.
29+
30+
*) Bugfix: a segmentation fault might occur in a worker process if
31+
errors with code 400 were redirected to a named location using the
32+
"error_page" directive.
33+
34+
*) Bugfix: nginx/Windows could not be built with Visual Studio 2013.
35+
36+
237
Changes with nginx 1.5.10 04 Feb 2014
338

439
*) Feature: the ngx_http_spdy_module now uses SPDY 3.1 protocol.

‎CHANGES.ru‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,40 @@
11

2+
Изменения в nginx 1.5.11 04.03.2014
3+
4+
*) Безопасность: при обработке специально созданного запроса модулем
5+
ngx_http_spdy_module на 32-битных платформах могла повреждаться
6+
память рабочего процесса, что потенциально могло приводить к
7+
выполнению произвольного кода (CVE-2014-0088); ошибка появилась в
8+
1.5.10.
9+
Спасибо Lucas Molas из Programa STIC, Fundación Dr. Manuel Sadosky,
10+
Buenos Aires, Argentina.
11+
12+
*) Добавление: переменная $ssl_session_reused.
13+
14+
*) Исправление: директива client_max_body_size могла не работать при
15+
чтении тела запроса с использованием chunked transfer encoding;
16+
ошибка появилась в 1.3.9.
17+
Спасибо Lucas Molas.
18+
19+
*) Исправление: при проксировании WebSocket-соединений в рабочем
20+
процессе мог произойти segmentation fault.
21+
22+
*) Исправление: в рабочем процессе мог произойти segmentation fault,
23+
если использовался модуль ngx_http_spdy_module на 32-битных
24+
платформах; ошибка появилась в 1.5.10.
25+
26+
*) Исправление: значение переменной $upstream_status могло быть
27+
неверным, если использовались директивы proxy_cache_use_stale или
28+
proxy_cache_revalidate.
29+
Спасибо Piotr Sikora.
30+
31+
*) Исправление: в рабочем процессе мог произойти segmentation fault,
32+
если ошибки с кодом 400 с помощью директивы error_page
33+
перенаправлялись в именованный location.
34+
35+
*) Исправление: nginx/Windows не собирался с Visual Studio 2013.
36+
37+
238
Изменения в nginx 1.5.10 04.02.2014
339

440
*) Добавление: модуль ngx_http_spdy_module теперь использует протокол

‎auto/cc/msvc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ fi
106106

107107
# precompiled headers
108108
CORE_DEPS="$CORE_DEPS $NGX_OBJS/ngx_config.pch"
109+
CORE_LINK="$NGX_OBJS/ngx_pch.obj"
109110
NGX_PCH="$NGX_OBJS/ngx_config.pch"
110111
NGX_BUILD_PCH="-Ycngx_config.h -Fp$NGX_OBJS/ngx_config.pch"
111112
NGX_USE_PCH="-Yungx_config.h -Fp$NGX_OBJS/ngx_config.pch"

‎src/core/nginx.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
#define _NGINX_H_INCLUDED_
1010

1111

12-
#define nginx_version 1005010
13-
#define NGINX_VERSION "1.5.10"
12+
#define nginx_version 1005011
13+
#define NGINX_VERSION "1.5.11"
1414
#define NGINX_VER "nginx/" NGINX_VERSION
1515

1616
#define NGINX_VAR "NGINX"

‎src/core/ngx_connection.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ ngx_set_inherited_sockets(ngx_cycle_t *cycle)
129129
#if (NGX_HAVE_INET6)
130130
case AF_INET6:
131131
ls[i].addr_text_max_len = NGX_INET6_ADDRSTRLEN;
132-
len = NGX_INET6_ADDRSTRLEN + sizeof(":65535") - 1;
132+
len = NGX_INET6_ADDRSTRLEN + sizeof("[]:65535") - 1;
133133
break;
134134
#endif
135135

@@ -244,7 +244,7 @@ ngx_set_inherited_sockets(ngx_cycle_t *cycle)
244244
if (getsockopt(ls[i].fd, SOL_SOCKET, SO_ACCEPTFILTER, &af, &olen)
245245
== -1)
246246
{
247-
err = ngx_errno;
247+
err = ngx_socket_errno;
248248

249249
if (err == NGX_EINVAL) {
250250
continue;
@@ -277,7 +277,7 @@ ngx_set_inherited_sockets(ngx_cycle_t *cycle)
277277
if (getsockopt(ls[i].fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, &timeout, &olen)
278278
== -1)
279279
{
280-
err = ngx_errno;
280+
err = ngx_socket_errno;
281281

282282
if (err == NGX_EOPNOTSUPP) {
283283
continue;
@@ -661,7 +661,7 @@ ngx_configure_listening_sockets(ngx_cycle_t *cycle)
661661
if (setsockopt(ls[i].fd, SOL_SOCKET, SO_ACCEPTFILTER, NULL, 0)
662662
== -1)
663663
{
664-
ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,
664+
ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_socket_errno,
665665
"setsockopt(SO_ACCEPTFILTER, NULL) "
666666
"for %V failed, ignored",
667667
&ls[i].addr_text);
@@ -688,7 +688,7 @@ ngx_configure_listening_sockets(ngx_cycle_t *cycle)
688688
&af, sizeof(struct accept_filter_arg))
689689
== -1)
690690
{
691-
ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,
691+
ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_socket_errno,
692692
"setsockopt(SO_ACCEPTFILTER, \"%s\") "
693693
"for %V failed, ignored",
694694
ls[i].accept_filter, &ls[i].addr_text);
@@ -721,7 +721,7 @@ ngx_configure_listening_sockets(ngx_cycle_t *cycle)
721721
&value, sizeof(int))
722722
== -1)
723723
{
724-
ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_errno,
724+
ngx_log_error(NGX_LOG_ALERT, cycle->log, ngx_socket_errno,
725725
"setsockopt(TCP_DEFER_ACCEPT, %d) for %V failed, "
726726
"ignored",
727727
value, &ls[i].addr_text);

‎src/core/ngx_resolver.c‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3037,14 +3037,7 @@ ngx_udp_connect(ngx_udp_connection_t *uc)
30373037
ngx_log_error(NGX_LOG_ALERT, &uc->log, ngx_socket_errno,
30383038
ngx_nonblocking_n " failed");
30393039

3040-
ngx_free_connection(c);
3041-
3042-
if (ngx_close_socket(s) == -1) {
3043-
ngx_log_error(NGX_LOG_ALERT, &uc->log, ngx_socket_errno,
3044-
ngx_close_socket_n " failed");
3045-
}
3046-
3047-
return NGX_ERROR;
3040+
goto failed;
30483041
}
30493042

30503043
rev = c->read;
@@ -3079,7 +3072,7 @@ ngx_udp_connect(ngx_udp_connection_t *uc)
30793072
ngx_log_error(NGX_LOG_CRIT, &uc->log, ngx_socket_errno,
30803073
"connect() failed");
30813074

3082-
return NGX_ERROR;
3075+
goto failed;
30833076
}
30843077

30853078
/* UDP sockets are always ready to write */
@@ -3093,16 +3086,23 @@ ngx_udp_connect(ngx_udp_connection_t *uc)
30933086
/* eventport event type has no meaning: oneshot only */
30943087

30953088
if (ngx_add_event(rev, NGX_READ_EVENT, event) != NGX_OK) {
3096-
return NGX_ERROR;
3089+
goto failed;
30973090
}
30983091

30993092
} else {
31003093
/* rtsig */
31013094

31023095
if (ngx_add_conn(c) == NGX_ERROR) {
3103-
return NGX_ERROR;
3096+
goto failed;
31043097
}
31053098
}
31063099

31073100
return NGX_OK;
3101+
3102+
failed:
3103+
3104+
ngx_close_connection(c);
3105+
uc->connection = NULL;
3106+
3107+
return NGX_ERROR;
31083108
}

‎src/event/ngx_event_openssl.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2528,6 +2528,20 @@ ngx_ssl_get_session_id(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
25282528
}
25292529

25302530

2531+
ngx_int_t
2532+
ngx_ssl_get_session_reused(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
2533+
{
2534+
if (SSL_session_reused(c->ssl->connection)) {
2535+
ngx_str_set(s, "r");
2536+
2537+
} else {
2538+
ngx_str_set(s, ".");
2539+
}
2540+
2541+
return NGX_OK;
2542+
}
2543+
2544+
25312545
ngx_int_t
25322546
ngx_ssl_get_raw_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
25332547
{

‎src/event/ngx_event_openssl.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,8 @@ ngx_int_t ngx_ssl_get_cipher_name(ngx_connection_t *c, ngx_pool_t *pool,
157157
ngx_str_t *s);
158158
ngx_int_t ngx_ssl_get_session_id(ngx_connection_t *c, ngx_pool_t *pool,
159159
ngx_str_t *s);
160+
ngx_int_t ngx_ssl_get_session_reused(ngx_connection_t *c, ngx_pool_t *pool,
161+
ngx_str_t *s);
160162
ngx_int_t ngx_ssl_get_raw_certificate(ngx_connection_t *c, ngx_pool_t *pool,
161163
ngx_str_t *s);
162164
ngx_int_t ngx_ssl_get_certificate(ngx_connection_t *c, ngx_pool_t *pool,

‎src/http/modules/ngx_http_access_module.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,11 @@ ngx_http_access_unix(ngx_http_request_t *r, ngx_http_access_loc_conf_t *alcf)
259259

260260
rule_un = alcf->rules_un->elts;
261261
for (i = 0; i < alcf->rules_un->nelts; i++) {
262-
return ngx_http_access_found(r, rule_un[i].deny);
262+
263+
/* TODO: check path */
264+
if (1) {
265+
return ngx_http_access_found(r, rule_un[i].deny);
266+
}
263267
}
264268

265269
return NGX_DECLINED;

‎src/http/modules/ngx_http_fastcgi_module.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1584,7 +1584,7 @@ ngx_http_fastcgi_process_header(ngx_http_request_t *r)
15841584
ngx_str_set(&u->headers_in.status_line, "200 OK");
15851585
}
15861586

1587-
if (u->state) {
1587+
if (u->state && u->state->status == 0) {
15881588
u->state->status = u->headers_in.status_n;
15891589
}
15901590

0 commit comments

Comments
 (0)